js-xss VS DOMPurify

Encode output data before user-controllable data is written to a page to prevent it from being interpreted as HTML or JavaScript. You can use tools like xss for this purpose.

xss-shield is a powerful middleware package that helps you protect your express.js app from Cross-Site Scripting (XSS) attacks. It's built on top of the popular xss (https://www.npmjs.com/package/xss) package and includes additional features like strict typing

I personally always tend to use this one. It's lightweight, configurable and has Typescript support built in

Searching for XSS specifically actually comes up with a few - https://www.npmjs.com/package/xss looks solid. I was being to literal in my search! Should have tried bing.

There are a few libraries you can use to protect from xss. For instance the xss library on npm.

After several hours of code review, I finally spotted something unfamiliar in the Markdown Renderer component: a function called escapeHTML was being used to escape HTML, even though DOMPurify was already being used for sanitization right after!

DOMPurify Documentation

Use libraries such as DOMPurify to sanitize input.

//https://github.com/cure53/DOMPurify import React from "react"; import DOMPurify from "dompurify"; const sanitize = (dirty) => DOMPurify.sanitize(dirty); const DangerousHtml = ({ innerHTML, tag }) => { const clean = sanitize(innerHTML); if (typeof tag === "undefined") { return

; } return ; }; export default DangerousHtml;

Input Sanitization: The most crucial step in preventing XSS attacks is to ensure that all user-generated content is properly sanitized before it is rendered on the page. Use libraries like DOMPurify or built-in sanitization functions provided by your framework (e.g., React's dangerouslySetInnerHTML) to strip out any potentially harmful code.

When using dangerouslySetInnerHTML, it is crucial to sanitize the HTML strings to prevent XSS attacks. DOMPurify is a robust library that cleans HTML content by removing or neutralizing potentially dangerous scripts or tags.

Since marked doesn't do it for you, make sure you sanitize the user input (the text on the user profiles) before rendering it to visitors.

Some libraries for doing that with good defaults:

- https://github.com/cure53/DOMPurify

- https://github.com/apostrophecms/sanitize-html

- https://github.com/bevacqua/insane

(right now your site looks vulnerable to XSS)

DOMPurify

I saw that some people were injecting alerts. If you haven't fixed it yet, consider using something like DOMPurify to sanitize the HTML input before posting it to the db.